General

  • Target

    PORT.bin.zip

  • Size

    118KB

  • Sample

    221128-p1kk9shh5t

  • MD5

    7bcb2e865a6a0524d59ee4c19b0b395e

  • SHA1

    99ac7a35df5ba16a9a07f188a407fa9b84d60042

  • SHA256

    baebeeb6fcbedfbffa1b36fbf3653cbcac41990335236dfd89956f0131a89e52

  • SHA512

    5efbbe7c6a875069684aabd6087d32c55089c616b24ad7d20f8d0334d3027666ab34fceb211d31fa638e1776b36d2e10af3658722176ac1b8aebee30e82426e7

  • SSDEEP

    3072:mKtfKkVtEy1ZbkeAToxjeaiMf7YfK9uZw:9tjtEuYTODTYfK9uS

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2699

Decoy

onlinemarketingsurgery.co.uk

skinkeeper.li

metroton.ru

fta-media.com

skolaprome.eu

carolynfriedlander.com

fotoslubna.com

stressreliefadvice.com

condormobile.fr

michal-s.co.il

andrealuchesi.it

1deals.com

hawthornsretirement.co.uk

gatlinburgcottage.com

voice2biz.com

enews-qca.com

thenalpa.com

modamarfil.com

primemarineengineering.com

internestdigital.com

Attributes
  • net

    false

  • pid

    48

  • prc

    mydesktopqos

    pvlsvr

    tbirdconfig

    agntsvc

    isqlplussvc

    vxmon

    CagService

    VeeamDeploymentSvc

    benetns

    winword

    ocomm

    firefox

    steam

    powerpnt

    dbeng50

    bengien

    visio

    mydesktopservice

    bedbh

    DellSystemDetect

    mspub

    thebat

    infopath

    encsvc

    synctime

    ocssd

    dbsnmp

    sql

    xfssvccon

    EnterpriseClient

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2699

  • svc

    MVarmor64

    backup

    memtas

    VSNAPVSS

    WSBExchange

    svc$

    MVArmor

    veeam

    bedbg

    BackupExecAgentBrowser

    BackupExecDiveciMediaService

    BackupExecVSSProvider

    MSExchange

    sophos

    AcrSch2Svc

    VeeamDeploymentService

    CAARCUpdateSvc

    PDVFSService

    BackupExecRPCService

    MSExchange$

    BackupExecJobEngine

    vss

    AcronisAgent

    MSSQL$

    stc_raw_agent

    VeeamNFSSvc

    BackupExecManagementService

    ARSM

    BackupExecAgentAccelerator

    VeeamTransportSvc

Extracted

Path

C:\fk1ov3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension fk1ov3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B7F10D35CB75BF11 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/B7F10D35CB75BF11 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: lSEz3S4I3V2OKcSt9wwYQiSQPTVkTJB1OoAXB8E1t35kOzHs3mzJrSEnJAT9zREr tPVXnWi+TLAkOhR+m0m2AuwkwJdWI4rWROnwGljJbYi9lj3SID8kEx9KRO2ryMnL /jQDIgDB3FdHJuzGu2MLjNcHGq5bzLAGfuxP67AwMvud+2bpmXoGlTsYX8yht35J cJyKbzIjvzUi1ihJTW1o3Nh/gkeSKMcen6cVDHef23Cgo4WXuhp5PE0+/BkRH8Xu 6cEBhZ7Gy7hDm6r0MUkaeIOOScf3Fg1gR4MbHzNI595GY0JnYQcUTGpSVp69qP3P qzClbg5Tx+R/D1bcSxEmIan7mWzKcdAalycmQxSDXZZMvg2kltRXqQoZxvrkc0vJ oRpxx77X8zxxjvW+8nA40t4vZrnSt+I3Exzw7HOHy/ytPTJogCzTjpbxVlTm+rMI 8i15b0D4pEYkv7JtMkB65eHQqYdRRn/iF9PEv2IEh/b9hha25kNHqGn370m8sDpF XatyBcSTFa+jz3esv4a9IUbRtOUrJOc3wVKsbxkRZkt05pI/zCg8yyeus1qmkpmf hucW6r1wpnoyJWP3/ntyPIX5/5OoLb8VgkA5OE3+Kz4yDKjbW35heYxKsNm7rlMM qnJsEIcMWnEQNjCgyZ7bAdxKdBLXVKLxOtIA7Q4o1pZaefgMyB9tQT0p7E9FjXpR BYWyYC0Mxga9KWPR1rwOllUmm0F1x7PHv/lQf/IcyJ2OnLrm8UMwkIgW4YhKwuGz R8y2Qfht9EA5r3uFrOixX26bp2nXD20NPea/OAX6gGfkuh6Uh7B1mIxP73JtoWu1 mBZxZSK7z3urwmjuukKy4gw1n3mUvytYmd05ftZ1IGKtgpVVEmWR1u/+US+RRSI1 RwLrNpaBwB+gsGB6ZY6QfT2QYEx/35ZQzXW9mSE5ekzEkUZ5+lRzYL5SoGwwQTPp i85SScKJE8kQygRpid33teCkfuTgAOgmeRk4EKu4qQirV4wfPyExP2Qbqh9dhYkg 2pCkUSBifJGrcaIAGbcnc2BdFAuYjpnGo5TCNgasVrUtDhb1qfHiwavCvJZBY4gI fRmWTM/nvFhvxW0IMdIlqDb8uhqhb1NRxNz33sqTZ8oJLwHHTagcYwchVOs= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B7F10D35CB75BF11

http://decryptor.top/B7F10D35CB75BF11

Targets

    • Target

      PORT.bin

    • Size

      164KB

    • MD5

      6268478bf01dc3eacfa23372ca8b59fa

    • SHA1

      f497026449bef302c235a1749ede57e7a077e159

    • SHA256

      b5e73c65a92abd6d8ea6040739e6b71a207035f1517f3813c56fbac937b8ff06

    • SHA512

      94ed316419f5350a845f4a988cf7b74703486fab2ba7ad0652f7280370915d8685d44447a59e8fe1f133d3923a1e929a96fe659a1b69202aae619193048345e6

    • SSDEEP

      3072:70XoUeZ/DVS8L7flcMTeYWikGLvFfK6uWc4mD7Fd:7eoUeZRlcYxWYTFf/UD

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks